Method of ensuring transactional integrity of a new subsystem that is added to a system that includes a trusted subsystem

Abstract

An identical request to process a transaction is initiated at a trusted subsystem of a system and a new subsystem of the system. Computed indicia of the transaction from both subsystems are compared at the trusted subsystem. An error condition is generated that indicates a logic error in the new subsystem when the comparison indicates that the computed indicia of the new subsystem does not match the computed indicia of the trusted subsystem. The error condition indicates a lack of transactional integrity in the new subsystem. The new subsystem may be taken out of service after the error condition is generated.

What is claimed is: 
     
       1. A method of ensuring transactional integrity of a new subsystem that is added to a system, the system including a trusted subsystem, each subsystem including (i) a processor, (ii) an application executing in the processor, (iii) an indicia engine, and (iv) an instance of a database used by the application, each subsystem executing transactions, each transaction including a BEGIN step, and one or more data manipulation language (DML) or data definition language (DDL) operations, the system performing the method comprising:
 (a) receiving at each subsystem an identical request to process a transaction; 
 (b) processing in the application executing in the processor at each subsystem the identical request in the instance of the subsystem's database; 
 (c) the indicia engine at each subsystem computing indicia of the outcome of the processing of the identical request in step (b), wherein the indicia is dependent upon at least a subset of the DML or DDL operations, and wherein the indicia is computed based on the DML or DDL operations made by the transaction; 
 (d) the indicia engine at the new subsystem sending its computed indicia to the trusted subsystem; and 
 (e) the indicia engine at the trusted subsystem:
 (i) comparing its computed indicia with the indicia received from the new subsystem, and 
 (ii) generating an error condition indicating a logic error in the new subsystem when the comparison indicates that the computed indicia of the new subsystem does not match the computed indicia of the trusted subsystem, wherein the error condition indicates a lack of transactional integrity in the new subsystem. 
 
 
     
     
       2. The method of  claim 1  wherein the indicia in step (c) is a hash sum or checksum. 
     
     
       3. The method of  claim 1  wherein the outcome of the processing of the identical request in step (b) is the one or more DML or DDL operations included in the transaction of step (a). 
     
     
       4. The method of  claim 1  wherein the new subsystem sending its computed indicia to the trusted subsystem via an Request to Commit (RTC) token. 
     
     
       5. The method of  claim 1  wherein each subsystem is a node of the system. 
     
     
       6. The method of  claim 1  further comprising:
 (f) taking the new subsystem out of service after the error condition is generated. 
 
     
     
       7. The method of  claim 1  wherein the logic error in the new subsystem is caused by one or more of a hardware error, a firmware error, a software error, or malware. 
     
     
       8. The method of  claim 1  wherein the new subsystem includes a new application. 
     
     
       9. The method of  claim 1  wherein the new subsystem includes a new processor. 
     
     
       10. The method of  claim 1  wherein each transaction further includes a transaction END step which is a COMMIT, and wherein the processing in step (b) further includes the transaction END step, the transaction thereby being committed at each subsystem.